BetterProxy
The local SMTP proxy that drops BetterSpam & BetterPhish verdicts into any mail server — and any mail-filtering pipeline — with a single API key.
BetterSpam, on your mail server
BetterProxy is the on-prem connector for BetterSpam. Run it as an SMTP proxy in front of (or beside) your existing MTA. It scores every message against the BetterSpam engine in real time, stamps the verdict into standard headers, and acts on the recommendation — pass, quarantine or reject. If the cloud is ever unreachable, it fails open so mail keeps flowing.
Quick start
Point BetterProxy at BetterSpam, put it in front of your backend, and you are filtering.
export BETTERPROXY_CLOUD_TOKEN=sk_your_api_key
betterproxy proxy \
--upstream=mail-internal:25 \
--script=examples/betterproxy-cloud.star \
--cloud-check-url=https://betterspam.com/api/v1/mail/check \
--cloud-submit-url=https://www.betterphish.io/api/v1/submit/email \
--cloud-privacy=fullAlso runs offline against sample messages and over mailboxes — same engine, no proxy required.
Standard verdict headers
Every message leaves with headers your downstream rules and dashboards can read — forged inbound copies are stripped first, so only BetterProxy's own verdict is ever trusted.
X-BetterSpam-Status: Yes, score=18.0, required=15.0, verdict=BOTH
X-BetterPhish-Verdict: phish, confidence=0.8
X-BetterProxy-Action: rejectSpam & phishing in one call
A single verdict — CLEAN, SPAM, PHISH or BOTH — from the BetterSpam engine, which aggregates reputation, Rspamd/SpamAssassin scoring and BetterPhish phishing intelligence.
Fails open, always
A cloud timeout or outage never blocks mail: BetterProxy accepts and marks the message, falling back to local SPF/DKIM/DMARC and ML scoring.
Privacy you control
Choose how much leaves your server: full message, headers only, or hash-only reputation. SSRF-hardened, redirect-refusing cloud client.
Local crypto verification
SPF, DKIM, DMARC, ARC and DANE recomputed from the message bytes — not read from a header a sender can forge.
Policy in Starlark
A Python-like rules language with 271 mail-aware builtins. Ship the included cloud policy as-is, or tailor pass/quarantine/reject thresholds to your org.
DKIM-safe
Verdict headers are added above the body — the message body is never rewritten, so pass-through DKIM signatures stay intact.